Prevent certificate tree corruption

Author: AlexVelezLl

morango/api/viewsets.py

@@ -4,6 +4,7 @@
 import uuid
 
 from django.core.exceptions import ValidationError
+from django.db import transaction
 from django.utils import timezone
 from ipware import get_client_ip
 from rest_framework import mixins
@@ -145,36 +146,41 @@ def create(self, request):
 
         if serialized_cert.is_valid():
 
-            # inflate the provided data into an actual in-memory certificate
-            certificate = Certificate(**serialized_cert.validated_data)
-
-            # add a salt, ID and signature to the certificate
-            certificate.salt = uuid.uuid4().hex
-            certificate.id = certificate.calculate_uuid()
-            certificate.parent.sign_certificate(certificate)
-
-            # ensure that the certificate model fields validate
-            try:
-                certificate.full_clean()
-            except ValidationError as e:
-                return response.Response(e, status=status.HTTP_400_BAD_REQUEST)
-
-            # verify the certificate (scope is a subset, profiles match, etc)
-            try:
-                certificate.check_certificate()
-            except errors.MorangoCertificateError as e:
-                return response.Response(
-                    {
-                        "error_class": e.__class__.__name__,
-                        "error_message": getattr(
-                            e, "message", (getattr(e, "args") or ("",))[0]
-                        ),
-                    },
-                    status=status.HTTP_400_BAD_REQUEST,
-                )
-
-            # we got this far, and everything looks good, so we can save the certificate
-            certificate.save()
+            # Use atomic transaction to prevent MPTT tree corruption during concurrent certificate creation
+            with transaction.atomic():
+                # lock the parent certificate row for update
+                parent = Certificate.objects.select_for_update().get(pk=serialized_cert.validated_data['parent'].pk)
+                serialized_cert.validated_data['parent'] = parent
+                # inflate the provided data into an actual in-memory certificate
+                certificate = Certificate(**serialized_cert.validated_data)
+
+                # add a salt, ID and signature to the certificate
+                certificate.salt = uuid.uuid4().hex
+                certificate.id = certificate.calculate_uuid()
+                certificate.parent.sign_certificate(certificate)
+
+                # ensure that the certificate model fields validate
+                try:
+                    certificate.full_clean()
+                except ValidationError as e:
+                    return response.Response(e, status=status.HTTP_400_BAD_REQUEST)
+
+                # verify the certificate (scope is a subset, profiles match, etc)
+                try:
+                    certificate.check_certificate()
+                except errors.MorangoCertificateError as e:
+                    return response.Response(
+                        {
+                            "error_class": e.__class__.__name__,
+                            "error_message": getattr(
+                                e, "message", (getattr(e, "args") or ("",))[0]
+                            ),
+                        },
+                        status=status.HTTP_400_BAD_REQUEST,
+                    )
+
+                # we got this far, and everything looks good, so we can save the certificate
+                certificate.save()
 
             # return a serialized copy of the signed certificate to the client
             return response.Response(

morango/sync/syncsession.py

@@ -14,6 +14,7 @@
 from requests.adapters import HTTPAdapter
 from requests.exceptions import HTTPError
 from requests.packages.urllib3.util.retry import Retry
+from django.db import transaction
 
 from .session import SessionWrapper
 from morango.api.serializers import CertificateSerializer
@@ -376,7 +377,9 @@ def certificate_signing_request(
         )
         csr_cert.private_key = csr_key
         csr_cert.check_certificate()
-        csr_cert.save()
+        # Use atomic transaction to prevent MPTT tree corruption during concurrent certificate creation
+        with transaction.atomic():
+            csr_cert.save()
         return csr_cert
 
     def push_signed_client_certificate_chain(